feat(desec): keep the typed slug across the registration flow

A slug typed into the deSEC form was lost when the form re-rendered after a
201 redirect (e.g. on the awaiting-verification step), forcing the user to
re-enter it. Persist the requested slug in the AIO config when register()
runs and pre-fill the slug input from it on every step, then clear it once a
domain is set. Stored in configuration.json rather than a URL parameter so it
survives the multi-step flow without leaking into the iframe address.

Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

php/public/index.php

@@ -205,6 +205,7 @@ $app->get('/desec', function (Request $request, Response $response, array $args)
         'domain' => $configurationManager->domain,
         'desec_email' => $configurationManager->desecEmail,
         'desec_password' => $configurationManager->desecPassword,
+        'desec_slug' => $configurationManager->desecSlug,
         'is_desec_domain' => $configurationManager->isDesecDomain(),
         'desec_account_registered' => $configurationManager->isDesecAccountRegistered(),
         'desec_awaiting_verification' => $configurationManager->isDesecAwaitingVerification(),

php/src/Data/ConfigurationManager.php

@@ -213,6 +213,16 @@ class ConfigurationManager
         set { $this->set('desec_email', $value); }
     }
 
+    /**
+     * The subdomain slug the user last requested. Persisted across the multi-step
+     * registration flow so the slug input can be pre-filled when the form re-renders
+     * (e.g. after email verification). Not a secret; cleared once a domain is set.
+     */
+    public string $desecSlug {
+        get => $this->get('desec_slug', '');
+        set { $this->set('desec_slug', $value); }
+    }
+
     /**
      * Base URL of the deSEC API. Configurable via the 'desec_api_base' config key
      * (configuration.json) only — intentionally NOT an environment variable — so the

php/src/Desec/DesecManager.php

@@ -45,6 +45,10 @@ class DesecManager {
 
         $validatedSlug = $this->validateSlug($slug);
 
+        // Persist the requested slug so the form can pre-fill it when it re-renders on the
+        // next step of the flow (e.g. after email verification). Cleared once a domain is set.
+        $this->configurationManager->desecSlug = $validatedSlug;
+
         [$token, $isNewAccount] = $this->obtainToken($email, $password);
 
         // An empty token means a brand-new account was created but its email is not yet
@@ -62,6 +66,8 @@ class DesecManager {
 
         $this->configurationManager->aioCommunityContainers = ["caddy", "dnsmasq"];
         $this->configurationManager->setDomain($domain, true);
+        // Registration is complete; the stored slug is no longer needed.
+        $this->configurationManager->desecSlug = '';
         $this->updateIpIfDesecDomain();
 
         return true;

php/templates/includes/desec-register.twig

@@ -7,7 +7,7 @@
         <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
         <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
         <input type="password" name="desec_password" placeholder="Existing deSEC password (only if you already had an account)" autocomplete="current-password" />
-        <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
+        <input type="text" name="desec_slug" value="{{ desec_slug|default('') }}" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
         <input type="submit" value="I have verified my email – register domain" />
     </form>
 {% elseif desec_account_registered %}
@@ -15,7 +15,7 @@
     <form method="POST" action="api/desec/register" class="xhr">
         <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
         <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
-        <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
+        <input type="text" name="desec_slug" value="{{ desec_slug|default('') }}" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
         <input type="submit" value="Register free domain via deSEC" />
     </form>
 {% else %}
@@ -26,7 +26,7 @@
         <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
         <input type="email" name="desec_email" placeholder="your@email.com" required />
         <input type="password" name="desec_password" placeholder="deSEC password (only if already registered)" autocomplete="current-password" />
-        <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
+        <input type="text" name="desec_slug" value="{{ desec_slug|default('') }}" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
         <input type="submit" value="Register free domain via deSEC" />
     </form>
     <p><strong>Note:</strong> By submitting this form you agree to the <a target="_blank" href="https://desec.io/terms">deSEC terms of service</a>. The registered domain and your deSEC account credentials are stored in the AIO configuration. After registration, set your router's DHCP DNS server to this machine's local IP address so LAN devices resolve the domain locally (see the <a target="_blank" href="https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq">dnsmasq documentation</a>). Alternatively adjust the hosts files on your clients so that they can reach the server using the local ip-address.</p>